GoPlus Security discloses that in AgentGuard AI, through "Historical Memory Injection" attacks, long-term memory is exploited to make the AI treat preferences as authorization, inducing sensitive operations such as refunds and transfers. Protective measures include: requiring real-time confirmation for related operations, treating "habits/old routines" as high risk, making long-term memory writes traceable, triggering secondary verification with ambiguous instructions, and ensuring long-term memory is not a substitute for real-time authorization. The AI memory system should be considered a potential attack surface and audited with a security framework.

MeNews

2026-05-23 00:36:07

Abstract generation in progress

ME News Report, May 15 (UTC+8), the GoPlus Security team disclosed a new type of attack in their AgentGuard AI project: inducing AI agents to perform sensitive operations without explicit authorization through "memory poisoning." The attack does not rely on traditional vulnerabilities or malicious code but exploits the AI agent's long-term memory mechanism. For example, an attacker might first induce the agent to "remember preferences," such as "usually prioritize refunds proactively rather than wait for chargebacks," then in subsequent instructions use vague phrases like "handle as usual" or "execute as before," triggering automated fund operations. GoPlus points out that the key risk of this type is that AI agents may mistake "historical preferences" as authorization grounds, leading to financial losses or security incidents during refunds, transfers, or configuration changes. To address this issue, the team proposes several protective measures, including:
· Operations involving refunds, transfers, deletions, or sensitive configurations must require explicit confirmation in the current session
· Memory commands like "habit," "usual way," or "as before" should be considered high-risk status changes
· Long-term memory must have traceability mechanisms (writer, timestamp, confirmation status)
· Vague instructions should automatically elevate risk levels and trigger secondary verification
· Long-term memory must not replace real-time authorization processes
The team emphasizes that "AI agent memory systems" should be regarded as a potential attack surface and constrained and audited through dedicated security frameworks. (Source: BlockBeats)

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

8 Likes

Reward
8
7
1
Share

Comment

Add a comment

Low-PolyEarth

· 5h ago

The AI safety framework needs to catch up quickly, or it could become a backdoor.

View OriginalReply0

LiquidationLineInTheReflection

· 5h ago

Memory injection is too insidious; AI treats habits as authorization, and upon reflection, it's terrifying.

View OriginalReply0

GateUser-8df0eb2b

· 5h ago

Long-term memory cannot replace real-time authorization; let's include this in the coding standards.

View OriginalReply0

0xSideQuest

· 5h ago

From now on, AI transfer should include a pop-up saying "Are you sure you're not being brainwashed?"

View OriginalReply0

WalletEarlyAccessAlarm

· 5h ago

Treat the memory system as an attack surface for auditing—that's the proper security mindset.

View OriginalReply0

GateUser-6d80555a

· 5h ago

Refund transfers must be confirmed immediately; delayed authorization = hidden danger

View OriginalReply0

GlassDomeObservatory

· 5h ago

Fuzzy command triggers secondary verification, which is equivalent to setting up a 'wakefulness check' for the AI.

View OriginalReply0

Trending Topics
View More
#
TradfiTradingChallenge
289.95K Popularity
#
PlatinumCardCreatorExclusive
87.46K Popularity
#
DailyPolymarketHotspot
1.04M Popularity
#
GateSquarePizzaDay
1.76M Popularity
#
SpaceXOfficiallyFilesforIPO
557.24K Popularity

Pinned

Sitemap

AI Agent Security Risks Revealed: Attackers Can Exploit "Memory Pollution" to Induce Fund Mishandling

Trending Topics

TradfiTradingChallenge

PlatinumCardCreatorExclusive

DailyPolymarketHotspot

GateSquarePizzaDay

SpaceXOfficiallyFilesforIPO

Pinned